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stores the network usage ^formation at the second level network data 
collector. 



31. (New) The system of claim 30, 
collector, wherein the third level network 
information converted to the standard dat 



er comprising a third level network data 
data collector receives processed network usage 
format from the first level network data collector 



or the second level network data collector processes and stores the network usage 
information at the third level network data collector. 

32. (New) The system of claim 30, jlvherein the network usage information comprises at 
least one of network usage data or netvvjork session data, comprising at least one of a source 
IP address, a destination IP address, bwe counts, packet counts, a time stamp and a username. 

33. (New) The system of claim 3D, wherein each first level network data collector 
comprises an encapsulator, an aggregator, and a data storage system, and the second level 
data collector is a correlator collector including an encapsulator, an aggregator, and a data 
storage system. 

34. (New) The system of claiU 33, wherein the first level encapsulator converts the 
network usage information to a srtandard data format, and the aggregator processes the 
converted network usage information including performing data reduction to provide 
aggregated data. 



35. (New) The system of /claim 34, further comprising a query manager in 
communication with the first/level network data collector and the second level network data 
collector; and each aggregator includes a data transfer interval such that the aggregator 
transfers aggregated data to /the data storage system at the data transfer interval, the query 
manager including a query interval where the second level data collector queries the first 
level data storage system for the aggregated data at the query interval via the query manager. 
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36. (New) A method for re wording network usage including storing network data in a 
multiple level data storage syst ?m, the method comprising the steps of: 

defining a set of first le^el network data collectors; 

receiving a first set of network usage information at each first level network data 

collector, processing and storing the first network usage information set at the 
first level network data collector; 

defining a second level network data collector; and 

receiving the first network usage information set at the second level network data 

collector from one or more first level network data collectors, processing the 
first network usage information set to produce a second network usage 
information/set, and storing the second network usage information set at the 
second level network data collector. 

37. (New) The method of claim 21 , where processing the first network usage information 
set includes converting Ahe first network usage information set to a standard data format, and 
aggregating the convened first network usage information set. 

38. (New) The method of claim 21 , where receiving the first set of network usage 
information includes defining the network usage information to comprise at least one of 
network usage data or network session data. 

39. (New) The method of claim 21 , further comprising querying the first level network 
data collector for the processed network usage information stored at the first level network 
data collector/ and transferring the processed network usage information to the second level 
network data collector. 
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